Common Weakness Enumeration
CWE-125
AllowedOut-of-bounds Read
Abstraction: Base · Status: Draft
The product reads data past the end, or before the beginning, of the intended buffer.
11270 vulnerabilities reference this CWE, most recent first.
GHSA-JR54-5C7X-45MX
Vulnerability from github – Published: 2022-05-13 01:49 – Updated: 2022-05-13 01:49
VLAI
Details
An issue has been discovered in Bento4 1.5.1-624. AP4_BytesToUInt16BE in Core/Ap4Utils.h has a heap-based buffer over-read after a call from the AP4_Stz2Atom class.
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2018-14585"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-07-24T16:29:00Z",
"severity": "HIGH"
},
"details": "An issue has been discovered in Bento4 1.5.1-624. AP4_BytesToUInt16BE in Core/Ap4Utils.h has a heap-based buffer over-read after a call from the AP4_Stz2Atom class.",
"id": "GHSA-jr54-5c7x-45mx",
"modified": "2022-05-13T01:49:59Z",
"published": "2022-05-13T01:49:59Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-14585"
},
{
"type": "WEB",
"url": "https://github.com/axiomatic-systems/Bento4/issues/299"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JR78-R957-84G6
Vulnerability from github – Published: 2022-10-12 12:00 – Updated: 2022-10-13 12:00
VLAI
Details
In avrc_ctrl_pars_vendor_rsp of avrc_pars_ct.cc, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-205570663
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2022-20410"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-10-11T20:15:00Z",
"severity": "HIGH"
},
"details": "In avrc_ctrl_pars_vendor_rsp of avrc_pars_ct.cc, there is a possible out of bounds read due to an integer overflow. This could lead to remote information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.Product: AndroidVersions: Android-10 Android-11 Android-12 Android-12L Android-13Android ID: A-205570663",
"id": "GHSA-jr78-r957-84g6",
"modified": "2022-10-13T12:00:26Z",
"published": "2022-10-12T12:00:22Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-20410"
},
{
"type": "WEB",
"url": "https://source.android.com/security/bulletin/2022-10-01"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JR7J-3VJJ-9C7J
Vulnerability from github – Published: 2024-11-17 06:30 – Updated: 2024-11-18 18:30
VLAI
Details
Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated "remote power off" actions (in broadcast mode) via multiple read operations on the ASTM Remote ID (0xFFFA) GATT.
Severity
7.5 (High)
{
"affected": [],
"aliases": [
"CVE-2024-52876"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2024-11-17T05:15:04Z",
"severity": "HIGH"
},
"details": "Holy Stone Remote ID Module HSRID01, firmware distributed with the Drone Go2 mobile application before 1.1.8, allows unauthenticated \"remote power off\" actions (in broadcast mode) via multiple read operations on the ASTM Remote ID (0xFFFA) GATT.",
"id": "GHSA-jr7j-3vjj-9c7j",
"modified": "2024-11-18T18:30:54Z",
"published": "2024-11-17T06:30:46Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2024-52876"
},
{
"type": "WEB",
"url": "https://coalfire.com/the-coalfire-blog/holy-stone-remote-id-vulnerability-disclosure"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JR8Q-JW7M-4M3M
Vulnerability from github – Published: 2022-05-13 01:03 – Updated: 2022-05-13 01:03
VLAI
Details
An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon ':'. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.
Severity
{
"affected": [],
"aliases": [
"CVE-2018-16866"
],
"database_specific": {
"cwe_ids": [
"CWE-125",
"CWE-200"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2019-01-11T19:29:00Z",
"severity": "LOW"
},
"details": "An out of bounds read was discovered in systemd-journald in the way it parses log messages that terminate with a colon \u0027:\u0027. A local attacker can use this flaw to disclose process memory data. Versions from v221 to v239 are vulnerable.",
"id": "GHSA-jr8q-jw7m-4m3m",
"modified": "2022-05-13T01:03:33Z",
"published": "2022-05-13T01:03:33Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-16866"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHBA-2020:0547"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:2091"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:3222"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:0593"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2020:1264"
},
{
"type": "WEB",
"url": "https://access.redhat.com/security/cve/CVE-2018-16866"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1653867"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2018-16866"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/May/25"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201903-07"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190117-0001"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3855-1"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2019/dsa-4367"
},
{
"type": "WEB",
"url": "https://www.qualys.com/2019/01/09/system-down/system-down.txt"
},
{
"type": "WEB",
"url": "http://packetstormsecurity.com/files/152841/System-Down-A-systemd-journald-Exploit.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2019/May/21"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2019/05/10/4"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/106527"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JR9J-FPM4-635P
Vulnerability from github – Published: 2022-05-12 00:00 – Updated: 2022-05-12 00:00
VLAI
Details
Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.
Severity
5.5 (Medium)
{
"affected": [],
"aliases": [
"CVE-2022-28264"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2022-05-11T18:15:00Z",
"severity": "MODERATE"
},
"details": "Acrobat Reader DC version 22.001.2011x (and earlier), 20.005.3033x (and earlier) and 17.012.3022x (and earlier) are affected by an out-of-bounds read vulnerability when parsing a crafted file, which could result in a read past the end of an allocated memory structure. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious file.",
"id": "GHSA-jr9j-fpm4-635p",
"modified": "2022-05-12T00:00:55Z",
"published": "2022-05-12T00:00:55Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2022-28264"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/acrobat/apsb22-16.html"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
GHSA-JR9W-7878-CFM9
Vulnerability from github – Published: 2022-05-24 19:16 – Updated: 2022-05-24 19:16
VLAI
Details
Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious TIF file.
{
"affected": [],
"aliases": [
"CVE-2021-39833"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-09-29T16:15:00Z",
"severity": "LOW"
},
"details": "Adobe Framemaker versions 2019 Update 8 (and earlier) and 2020 Release Update 2 (and earlier) are affected by an out-of-bounds read vulnerability that could lead to disclosure of sensitive memory. An attacker could leverage this vulnerability to bypass mitigations such as ASLR. Exploitation of this issue requires user interaction in that a victim must open a malicious TIF file.",
"id": "GHSA-jr9w-7878-cfm9",
"modified": "2022-05-24T19:16:06Z",
"published": "2022-05-24T19:16:06Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2021-39833"
},
{
"type": "WEB",
"url": "https://helpx.adobe.com/security/products/framemaker/apsb21-74.html"
}
],
"schema_version": "1.4.0",
"severity": []
}
GHSA-JRC8-CM2R-WC39
Vulnerability from github – Published: 2022-05-17 02:52 – Updated: 2022-05-17 02:52
VLAI
Details
The base64encode function in base64.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds read) via a crafted plist file.
Severity
5.0 (Medium)
{
"affected": [],
"aliases": [
"CVE-2017-6437"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2017-03-15T14:59:00Z",
"severity": "MODERATE"
},
"details": "The base64encode function in base64.c in libimobiledevice libplist 1.12 allows local users to cause a denial of service (out-of-bounds read) via a crafted plist file.",
"id": "GHSA-jrc8-cm2r-wc39",
"modified": "2022-05-17T02:52:21Z",
"published": "2022-05-17T02:52:21Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2017-6437"
},
{
"type": "WEB",
"url": "https://github.com/libimobiledevice/libplist/issues/100"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/97291"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:L/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JRCM-4657-67WP
Vulnerability from github – Published: 2022-05-17 03:38 – Updated: 2022-05-17 03:38
VLAI
Details
Out-of-Bounds read vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attackers to execute arbitrary code via a crafted BMP image embedded in the XFA stream in a PDF document, aka "Data from Faulting Address may be used as a return value starting at FOXITREADER."
Severity
8.8 (High)
{
"affected": [],
"aliases": [
"CVE-2016-8878"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2016-10-31T10:59:00Z",
"severity": "HIGH"
},
"details": "Out-of-Bounds read vulnerability in Foxit Reader and PhantomPDF before 8.1 on Windows, when the gflags app is enabled, allows remote attackers to execute arbitrary code via a crafted BMP image embedded in the XFA stream in a PDF document, aka \"Data from Faulting Address may be used as a return value starting at FOXITREADER.\"",
"id": "GHSA-jrcm-4657-67wp",
"modified": "2022-05-17T03:38:27Z",
"published": "2022-05-17T03:38:27Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-8878"
},
{
"type": "WEB",
"url": "https://www.foxitsoftware.com/support/security-bulletins.php"
},
{
"type": "WEB",
"url": "http://www.securityfocus.com/bid/93608"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JRCR-MFPR-RGG9
Vulnerability from github – Published: 2022-05-13 01:25 – Updated: 2022-05-13 01:25
VLAI
Details
Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.
Severity
9.1 (Critical)
{
"affected": [],
"aliases": [
"CVE-2018-18313"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2018-12-07T21:29:00Z",
"severity": "CRITICAL"
},
"details": "Perl before 5.26.3 has a buffer over-read via a crafted regular expression that triggers disclosure of sensitive information from process memory.",
"id": "GHSA-jrcr-mfpr-rgg9",
"modified": "2022-05-13T01:25:18Z",
"published": "2022-05-13T01:25:18Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2018-18313"
},
{
"type": "WEB",
"url": "https://github.com/Perl/perl5/commit/43b2f4ef399e2fd7240b4eeb0658686ad95f8e62"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:0001"
},
{
"type": "WEB",
"url": "https://access.redhat.com/errata/RHSA-2019:0010"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1646738"
},
{
"type": "WEB",
"url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/RWQGEB543QN7SSBRKYJM6PSOC3RLYGSM"
},
{
"type": "WEB",
"url": "https://metacpan.org/changes/release/SHAY/perl-5.26.3"
},
{
"type": "WEB",
"url": "https://rt.perl.org/Ticket/Display.html?id=133192"
},
{
"type": "WEB",
"url": "https://seclists.org/bugtraq/2019/Mar/42"
},
{
"type": "WEB",
"url": "https://security.gentoo.org/glsa/201909-01"
},
{
"type": "WEB",
"url": "https://security.netapp.com/advisory/ntap-20190221-0003"
},
{
"type": "WEB",
"url": "https://support.apple.com/kb/HT209600"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3834-1"
},
{
"type": "WEB",
"url": "https://usn.ubuntu.com/3834-2"
},
{
"type": "WEB",
"url": "https://www.debian.org/security/2018/dsa-4347"
},
{
"type": "WEB",
"url": "https://www.oracle.com/security-alerts/cpujul2020.html"
},
{
"type": "WEB",
"url": "http://seclists.org/fulldisclosure/2019/Mar/49"
},
{
"type": "WEB",
"url": "http://www.securitytracker.com/id/1042181"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"type": "CVSS_V3"
}
]
}
GHSA-JRH2-F82P-H3MV
Vulnerability from github – Published: 2022-05-24 19:08 – Updated: 2022-05-24 19:08
VLAI
Details
An issue was discovered in heif::Box_iref::get_references in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impact due to an invalid memory read.
{
"affected": [],
"aliases": [
"CVE-2020-19499"
],
"database_specific": {
"cwe_ids": [
"CWE-125"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2021-07-21T18:15:00Z",
"severity": "HIGH"
},
"details": "An issue was discovered in heif::Box_iref::get_references in libheif 1.4.0, allows attackers to cause a Denial of Service or possibly other unspecified impact due to an invalid memory read.",
"id": "GHSA-jrh2-f82p-h3mv",
"modified": "2022-05-24T19:08:32Z",
"published": "2022-05-24T19:08:32Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2020-19499"
},
{
"type": "WEB",
"url": "https://github.com/strukturag/libheif/issues/138"
},
{
"type": "WEB",
"url": "https://github.com/strukturag/libheif/commit/f7399b62d7fbc596f1b2871578c1d2053bedf1dd"
}
],
"schema_version": "1.4.0",
"severity": []
}
Mitigation MIT-5
Implementation
Strategy: Input Validation
- Assume all input is malicious. Use an "accept known good" input validation strategy, i.e., use a list of acceptable inputs that strictly conform to specifications. Reject any input that does not strictly conform to specifications, or transform it into something that does.
- When performing input validation, consider all potentially relevant properties, including length, type of input, the full range of acceptable values, missing or extra inputs, syntax, consistency across related fields, and conformance to business rules. As an example of business rule logic, "boat" may be syntactically valid because it only contains alphanumeric characters, but it is not valid if the input is only expected to contain colors such as "red" or "blue."
- Do not rely exclusively on looking for malicious or malformed inputs. This is likely to miss at least one undesirable input, especially if the code's environment changes. This can give attackers enough room to bypass the intended validation. However, denylists can be useful for detecting potential attacks or determining which inputs are so malformed that they should be rejected outright.
- To reduce the likelihood of introducing an out-of-bounds read, ensure that you validate and ensure correct calculations for any length argument, buffer size calculation, or offset. Be especially careful of relying on a sentinel (i.e. special character such as NUL) in untrusted inputs.
Mitigation
Architecture and Design
Strategy: Language Selection
Use a language that provides appropriate memory abstractions.
CAPEC-540: Overread Buffers
An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.